Monero Ring Signatures Explained: Ring Size, Decoys and FCMP++

Monero ring signatures are how the network hides who sent a payment. When you spend, your wallet mixes your real coin with 15 decoys taken from the blockchain, a ring size of 16, and signs the transaction so that anyone can verify that one of the 16 approved it, but no one can see which. This page goes deeper than our overview of how Monero works: how the ring is built, what a key image is, where the research says rings fall short, and what the planned FCMP++ upgrade changes.

The short answer

A ring signature lets a group sign something together while the signature only proves that one member signed. The Monero project describes it as a signature that could have been produced by any member of a group of keys, where it should be computationally infeasible to tell which member did it. Monero builds the group on the fly, with no setup and no permission from the other members, using outputs that already sit on the public blockchain.

Ring signatures cover one job: hiding the sender. Hiding the receiver is the work of stealth addresses, and hiding the amount is the work of RingCT. The three together make a transaction private. This page stays on the first one.

An analogy: the signed petition

Picture a petition signed in a room of 16 people. When it comes out, it carries a stamp that says, truthfully, "one of the people in this room signed this." The stamp cannot be forged by an outsider, and it cannot be traced to a person. Now imagine that the other 15 people never knew they were in the room. Their names were borrowed from public records, and they did nothing.

That is close to what a Monero ring is. The 15 decoys are real coins from other people's past transactions. They do not take part and they lose nothing. Their only job is to be plausible, so that you could be any one of the 16.

Ring size: why 16

The ring size is the total number of possible signers in a ring. The current figure is 16, which means the real input plus 15 decoys, and it stays 16 until the FCMP++ upgrade replaces rings. The Monero technical documentation states it as "the ring size is 16 (15 decoys)."

The number has grown over time. In the early years, users could pick any ring size, including zero decoys, which made some transactions easy to trace and weakened everyone else's decoys. Monero fixed the ring size at 11 in version 0.13.0 so that all transactions would look alike, then raised it from 11 to 16 in the network upgrade of 13 August 2022.

Why not make it enormous? Every extra ring member adds data to each transaction, which makes it larger, costs more in fees, and takes more work for every node to verify. Rings of a few dozen would be possible, but the privacy gain per extra member shrinks while the cost keeps growing. That trade-off is one of the reasons the project is working on a different approach (see below).

How decoys are chosen

You do not pick your decoys. Your wallet does, using a rule that every Monero wallet shares. Per the Monero project's description, the other ring members are selected from the blockchain with a gamma distribution. In plain words: a statistical curve that makes the wallet more likely to choose recent outputs and less likely to choose very old ones, because that matches how real people tend to spend. Most coins are spent soon after they arrive, so a believable decoy is usually a young one.

The goal is that your real coin is indistinguishable from the decoys by age. If your real coin was received an hour ago, the wallet should choose decoys of similar ages, not 16 coins that are years apart.

Key images stop double spends

Hiding the sender raises a problem. If nobody knows which coin was spent, what stops you from spending the same coin twice in two different rings? The answer is the key image.

When you spend a coin, your wallet produces a key image: a short value calculated from the coin's secret key. Three properties make it work. It is the same every time for the same coin. It is different for every coin. And it does not reveal which coin it came from. Each transaction publishes its key images, and nodes keep the full list of all key images ever used.Any new transaction that repeats a key image on that list is rejected.

There is a quiet consequence worth knowing. The network learns that one of the 16 ring members is now spent for good, but not which one. Ring members that are decoys are not touched, and their real owners can still spend them.

What a ring does and does not hide

A ring hides which input in a transaction was yours. It does not hide everything, and it helps to be exact about the edges.

Amounts are hidden by a different tool, and receivers by another. Network-level exposure, such as what a remote node can see, is separate again. We cover that honestly in is Monero traceable.

Known limits and research

Ring signatures give plausible deniability, not mathematical certainty. The ring is only as strong as its decoys, and researchers have studied where it can weaken. Here is a fair summary of what the public record shows.

• Early weaknesses were real and have been fixed. Before ring size was mandatory, rings with few or zero decoys let analysts trace spends and then trace the transactions linked to them. The Monero Research Lab's MRL-0001 studied how such chains of deduction can spread. A mandatory ring size is the main fix.
• Statistical guessing is possible. The Monero Research Lab project OSPEAD, led by researcher Rucknium, studied the decoy selection rule against real spending. The project's 2025 write-up states that the current decoy algorithm relies on data from Monero's first three years and has changed little since, and that a "MAP Decoder" attack could give an adversary about a 1 in 4.2 chance of guessing the real spend, instead of 1 in 16. The same post notes that the attacker rarely learns whether a guess was right, which limits real-world impact, and that the risk is higher for users with extreme threat models. The work has not yet been formally peer reviewed.
• Hostile surroundings matter. If an adversary controls many outputs that end up as decoys, they can rule those out and shrink your effective ring. This is one reason a bigger anonymity pool helps every user.

Behaviour counts too. Spending a coin the moment it arrives, or reusing a pattern that is easy to spot, makes your real input easier to guess. The ring helps most when you act like everyone else.

FCMP++: the planned replacement

FCMP++ (Full-Chain Membership Proofs) would replace rings altogether: instead of proving your coin is one of 16 outputs, you prove it is one of all eligible outputs on the chain, without saying which, so there would be no decoys left to guess. As of 15 October 2026 it is in public testing on a stressnet whose coins have no value, the developers' latest beta release is from September 2026, and no mainnet date has been set, so rings of 16 still protect every transaction on the main network. Our guide to FCMP++ and Carrot covers what it changes for you and what to do when it ships.

What this means for you

You do not need to do anything to benefit from ring signatures. A few habits help them do their job:

• Use a current wallet, so it follows the network's latest rules for ring size and decoys.
• Do not try to customize anything about how a transaction is built. Uniformity is the whole point.
• Remember the other layers. A ring cannot protect you from an exchange that knows your identity, or from an address you posted next to your name.

MonkStash builds transactions with the standard Monero library, so every payment you send from your MonkStash wallet uses the network's ring rules without a setting to change. New to all of this? What is Monero is the gentlest starting point, and Monero vs Bitcoin shows why the difference matters, while Monero vs Zcash compares a different privacy design. Primary sources: the Monero technical specifications and the OSPEAD research post.